digital-forensics-lab: a course repository of PowerPoint labs and real case files

A course repository, not a tool collection

The description says it plainly: free hands-on digital forensics labs for students and faculty. The README expands that to a shared cyber forensic intelligence repository, and the difference in wording is the whole design. Nothing here is a tool you install. What you get are PowerPoint decks, associated case files, screenshots, and two structured datasets.

The feature list is written for an instructor rather than a practitioner, and the choices in it are deliberate. Labs use Kali Linux exclusively, which removes the variable of students arriving with different operating systems. Each lab ships with a presentation, its associated files and instructional screenshots, so the material works for a student working alone as well as in a room. All the tools used are free and open source, and the whole thing is supported by grants from the DOJ, DHS and NSF with a stated commitment to regular updates.

The most recent addition noted in the index is Eufy investigations from October 15, 2024, which gives you a sense of the update cadence. The repository is not archived, last pushed 2026-09-23, with 2980 stars, 625 forks and 11 open issues. The license field is NOASSERTION in the repository metadata even though a `LICENSE` file is present in the tree, so reuse terms are worth checking directly rather than assuming.

The basics come first, and they are not glamorous

The first block of the index is Basic Computer Skills for Digital Forensics, and it is the block most likely to be skipped by someone in a hurry, which is a mistake. It opens with Number Systems, and the parenthetical note tells you Python data-conversion code was added in January 2023. That is a clue about how the material is used: hexadecimal conversion is not a warm-up exercise here, it is a skill students need for carving, hashing and reading raw output.

Then come five decks in sequence: PC Introduction, a Windows command line tutorial, a Linux command line tutorial, and an advanced Linux command line tutorial. Having both operating systems covered matters because most case files in the repository come from Windows machines, while the lab environment is Linux.

From there the Computer and Digital Forensics section, last updated October 2021, moves into the actual discipline with an introduction, a Sleuth Kit tutorial, USB image acquisition, and two evidence search decks, one framed as a pattern match game and updated in May 2022, the other on file metadata. It closes with data carving, steganography and a forensic report template shipped as a PDF, which is the one artifact in the index that students can hand in.

Networking forensics with Scapy and NetfilterQueue

The networking block was added on March 17, 2023, and the README names its dependencies: the Python Scapy and NetfilterQueue libraries. Naming libraries is unusual for a slide deck index and tells you these labs expect students to write something rather than click through a GUI.

The sequence builds up. HTTP analysis using Wireshark comes in a text version and an image version, which is a simple accessibility accommodation that also lets one be used as a reference while the other is presented. Then a SYN flood attack investigation using TShark, SMTP forensics, ARP poisoning forensics, a firewall lab framed around dropped packets, a DNS introduction, and DNS spoofing forensics.

The wireless material is dated in a way worth noticing. The deck is named for WEP40 and Aircrack, which is the weak-legacy-hardware case rather than WPA. For a course this is arguably the right choice, since cracking a trivially weak key is something a student can complete in a class period, but it does mean the lab does not teach the current state of wireless forensics.

Wireshark and TShark appearing in the same index is itself informative, since they share a core. The repository is teaching packet analysis as a skill rather than introducing a new tool per topic.

Case studies as the spine of the course

The case studies are the part that makes this repository different from a tool tutorial collection, and each is a full investigation rather than an exercise. The list includes investigating NIST data leakage on Windows XP, P2P data leakage on Windows 10, illegal possession of images framed in the README as networking forensics, email harassment, an illegal file transfer examined through memory forensics, a hacking case, and the Morris Worm attack, which has an accompanying poster and was updated in January 2023.

The variety of evidence type is the point. Disk imaging, network traffic, email headers, memory artefacts and historical malware each need a different acquisition and analysis path, and running through several in one course is how students learn that a case is defined by its evidence rather than by its question.

The mobile and IoT block is the most current part of the index and covers a Eufy doorbell added October 15, 2024, an Echo Show 8 added December 25, 2023, Android 10 added October 24, 2021, an iPhone on iOS 13 updated June 18, 2022, and a DJI drone added December 7, 2021. Consumer IoT is a fast moving target, and having a doorbell lab newer than the drone lab by three years shows the teaching side keeping up with what investigators actually get handed.

JSON forensic intelligence built from real cases

The feature list mentions two structured forensic intelligence datasets in JSON format derived from real case studies, and the index locates them under `STIX_for_digital_forensics/`, with entries for Email Forensics and Illegal Possession of Images. STIX is the standard vocabulary for expressing cyber threat intelligence, so the choice to publish the datasets in that shape means they can be loaded into existing tooling rather than only read as documents.

That is the most reusable asset in the repository. A student can take the email harassment dataset and build tooling against it, and an instructor can assign the same exercise across a term. Two case domains is a small number, so this is a starting point rather than a corpus.

The tree also holds directories that do not appear in the README index at all: `Bitcoin/`, `Digital_Currency/`, `Log4JShell/`, `Help/`, and `papers/`. The presence of Log4jShell and cryptocurrency material suggests case material added ahead of the index catching up, and the .code-workspace file at the root hints that at least some of the work is expected to happen inside an editor with the notebooks open.

The book, the companion repository and who they are for

A significant part of the README is now about a book rather than the repository. The second edition of Digital Forensics Basics: A Step-by-Step Guide for Beginners is 649 pages and, by the README's own description, builds on selected content from this repository, reorganizing and expanding it into a chapter-by-chapter path for beginners, independent learners and instructors.

That phrasing is careful and worth repeating: the repository is not the book, and the README says the table of contents it presents is for this repository, not for the book. A dedicated companion repository holds chapter-aligned presentations, downloadable lab and evidence files, expanded evidence search material, the Windows command line tutorial, study and lab guidance, and curated tool references.

The access model is also spelled out. Faculty members are eligible for a complimentary desk copy of the PDF, requested by emailing from an institutional address with a link to a faculty profile or university webpage. For feedback or to describe how you use the course materials, the README gives an address at a Baltimore-area institution, obfuscated in the obvious way.

Editorial conclusion

digital-forensics-lab is one of those repositories that saves a working academic considerable work, and the giveaway is the timestamp discipline: nearly every lab in the index carries the month it was added or last revised, so a reader can tell which parts reflect current practice and which are historical. That matters most for the older Windows XP and Windows 10 leakage cases, which are still valuable as teaching artifacts even though the tooling has moved on. The Kali-only constraint is a strength for a classroom, since students get one consistent environment, and a limitation for anyone wanting to see how the same investigation would run on a non Linux forensic workstation. Start with the basic computer skills section, which builds number systems and command line fluency before any case, then pick one dated case study end to end. The STIX JSON datasets under `STIX_for_digital_forensics/` are the part most likely to be useful outside a classroom.

Frequently asked questions

Official sources

1. frankwxu/digital-forensics-lab on GitHub
2. Issues
3. Project website
4. README